Cookie Policy
Last updated: September 7, 2026. Your browser controls can clear site data, but doing so may sign you out or remove local preferences.
Authentication
Secure HttpOnly SameSite cookies maintain a signed-in or short-lived recovery session. They do not contain passwords or recovery codes.
Security
Rate limiting, CSRF/origin validation, passkey challenges, and trusted-session protections may use short-lived server or browser state.
Preferences
Theme and your cookie-consent choice are stored in browser localStorage (the theme and cookie-consent keys); workspace layout and guest session choices may also be stored locally.
Analytics
Google Analytics 4 measures aggregate usage through this site's property and the Novus network roll-up. One consent-gated Google tag configures both destinations. Analytics and advertising signals default to denied in the EEA, UK, and Switzerland until you accept, your saved choice is reapplied on return visits, and Global Privacy Control overrides a saved grant. Withdrawing analytics consent immediately denies both destinations, expires applicable Google measurement cookies, and reloads once when the tag has already run. First-party Vercel Web Analytics and Speed Insights measure page and interaction performance without advertising cookies.
Advertising
Marketing routes may show Adsterra banners, native units, and rails. In the EEA, the UK, and Switzerland no advertising script is loaded until you accept in the consent banner; elsewhere ads may load before a choice is made, and Essential Only turns them off. Classic, Studio, account, admin, legal, security, and accessibility routes carry no ad units. Starting an export may open one Adsterra sponsor page in a separate tab, one tab per export and never more than one, and skipped entirely without advertising consent; that sponsor tab sets no cookie or storage key of its own. One first-party cookie, nss_ads_optout, is written only if you open a Novus page with ?nss_ads=off. It stores a single flag recording that no ad should be requested for this browser, is scoped to novusstreamsolutions.com so one visit covers every Novus site, expires after two years, contains no identifier, and is removed by ?nss_ads=on. Google AdSense remains listed in ads.txt for possible future use but its script is not loaded.
Project data
Signed-in projects are stored in Turso, not cookies. Private assets use Vercel Blob. Guest work is stored device-locally in your browser using IndexedDB and can be exported as .novusvis; clearing site data removes it.